Information Management Assessment

Action plan progress review

Ministry of Justice (MoJ)

Reviewed November 2017

Published February 2018

Working with government to raise standards in information management Contents

Background and action plan development 03 Summary of progress since the IMA 04 Next steps 07

© Crown copyright 2017.

You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0.

Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk Background

The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management.

The Ministry of Justice (MoJ) IMA took place in May 2016. This progress review summarises key developments since the IMA. Areas where continued attention is still needed are listed below under ‘Next Steps.’

Action plan development

MoJ promptly produced a detailed action plan following the IMA and the Knowledge and Information Management team discussed progress against the recommendations with its Deputy Director. The National Archives formally assessed progress against the action plan in November 2017. The IMA report and updated action plan are both published on The National Archives’ website.¹

¹ http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/ Summary of progress since the IMA

1 The value of information

| Performance rating | IMA 2016 | Review 2017 | |--------------------|-------------------|----------------------------------| | Communicating and | Development area | Progressing towards satisfactory | | realising value | | | | Managing information as an asset | Satisfactory | Progressing towards good |

Recommendations: 1, 2 and 3

- The Ministry of Justice (MoJ) has now developed an Information Management Strategy, a key gap identified at the time of the IMA. This was approved by the Information Risk and Security Board in July 2017. It is now being aligned with MoJ’s digital strategy and is also tied in with the department’s approach to implementing the General Data Protection Regulation (GDPR). See next steps
- MoJ has continued to develop and embed its approach to managing its information assets including reviewing and updating guidance, training and the Information Asset Register template. Information assurance roles have been reviewed to ensure that the right personnel continue to be in place to support this work.

2 Digital information and supporting technology

| Performance rating | IMA 2016 | Review 2017 | |--------------------|-------------------|----------------------------------| | Supporting information through technology | Development area | Progressing towards satisfactory | | Digital continuity and IT change | Development area | Progressing towards satisfactory |

Recommendations: 4

- The rollout of Just Store (MoJ’s new system for managing digital records throughout their lifecycle) was completed in April 2017. Feedback has been positive and other teams, outside the core rollout group, are asking if they can have the system as well.
- The Knowledge and Information Management (KIM) team are working closely with Digital Technology on the rollout of Office 365 and SharePoint Online to ensure that information and records management requirements are taken into account. This has included a phased approach to the rollout of SharePoint Online and piloting RecordPoint to enable disposal in SharePoint Online. See next steps
- Options are being explored to gain greater oversight of and to better manage information on shared drives, including looking at several e-discovery/analytical tools. Technology have also begun the Arc project to freeze shared drives and identify redundant or trivial material that can be disposed of before migrating to Office 365. See next steps

3 Information risk, governance and oversight MoJ continues with its good practice approach to recognising and managing information risk. The Senior Information Risk Owner (SIRO) Board has been renamed the Information Risk and Security (IRS) Board and a restructure was agreed in summer 2017. As recommended, cyber security risks are now included on the IRS information risk register. Descriptions of information management related risks are continuing to evolve in a way that reflects the changing IT environment, including the introduction of Just Store. The department’s active approach is underlined by the identification of a new risk relating to the accessibility of online tools. Information Assurance Leads have now been moved from functional business areas into a central team to enable closer collaboration. Guidance and training includes information on the various information assurance roles to improve awareness and understanding of these.

Now the roll out of Just Store is complete, the KIM Champion role is to be discontinued. Responsibility for championing information and records management in business areas will sit with Information Asset Owners. See next steps

Rollout of Just Store was supported by a comprehensive package of training and guidance and use has been promoted by senior staff including directors and KIM Champions which addresses concerns about maintaining senior level backing for work to drive information management culture. Guidance on what to keep was revised and published as part of the ‘Spring Clean Your Information’ campaign in May 2017 and MoJ has continued to ensure that retention schedules are published in line with recommendations in Sir Alex Allan’s 2014 report, Records Review. Work has started to review and update all guidance to reflect new IT environment and GDPR.

MoJ is yet to develop a process for monitoring compliance with information management policy. See next steps

4 Records, review and transfer

MoJ has maintained progress with paper review and is planning ahead to ensure that it continues to keep pace with the transition to the 20 Year Rule. Work has included ascertaining how much paper there is to process in the next five years, looking at ways of speeding up the appraisal process and making a business case for extra staff. **See next steps**

- As recommended, MoJ is in the process of enabling use of DROID (The National Archives’ file profiling tool) to facilitate the transfer of digital information to The National Archives.
- Work to appraise material on the shared drives will be progressed once the work to roll out Office 365 is complete (see also section 2) and the team is aiming to reuse the process/principals that it established for appraisal and selection of material on TRIM (MoJ’s original system for managing digital records) and Just Store. **See next steps**
- As of yet MoJ has not established a process for the sensitivity review of digital information. **See next steps** Next Steps

The National Archives will continue to support the Ministry of Justice in its work on information and records management so that it is supported through to the time of its next IMA. In the interim, we recommend that the following points are focussed on and built into departmental business planning:

- Launch the Information Management Strategy and develop a process for reporting on implementation of the strategy to the senior team and an opportunity for the team to scrutinise progress, via the Information Risk and Security (IRS) Board
- Ensure that guidance and training for Information Asset Owners includes responsibilities for information management, for example, promoting messages around knowledge, information and records management and ensuring that staff are complying with information management policy. Emphasise that this is a core requirement of the role that supports wider information assurance considerations.
- Ongoing work with digital technology on ensuring that systems adequately support information and records management including managing email within the Office 365 environment, implementing disposal, statistics on usage of systems and the shared drive project.
- Develop a process of monitoring compliance with information management policy drawing on good practice examples such as HM Treasury.
- Seek to develop a process for sensitivity review of digital records drawing on work carried out by The National Archives and other government departments.
- Ensure that a digital continuity plan is in place for digital records inherited from inquests/inquiries.
- Continue to explore ways of streamlining the process of appraisal and selection of paper records and ensuring that this also feeds into process for future digital appraisal and selection. This will be particularly important if the business case to get extra staff is unsuccessful.
- Consider using DROID to identify digital continuity risks (for example, age, format of digital holdings) and to track how these are being mitigated through the IRS information risk register.